Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2023, 01:55

General

  • Target

    48e04150e7b404074aa12bd9aaf09cb0aad81cefab68f5f6cf599d46163bd8ad.exe

  • Size

    820KB

  • MD5

    d0ae46ea0d24772846b18acd4211de96

  • SHA1

    7af0868cb2cda911eb4d35737263b6c0f021c318

  • SHA256

    48e04150e7b404074aa12bd9aaf09cb0aad81cefab68f5f6cf599d46163bd8ad

  • SHA512

    b65b8c463ce11127ff8e2cea7becf6ecfca905f11c436f890b7480f7af47940a7cad2703ad6a20ead4df58d291e8843178c75f14f239499228bb7428e0bad39e

  • SSDEEP

    24576:dd0JhnI2hCKgNDiHk3iMJxtEyqi2xapQs5:D+hI2FEDiHk9Jxt3nF

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\48e04150e7b404074aa12bd9aaf09cb0aad81cefab68f5f6cf599d46163bd8ad.exe
    "C:\Users\Admin\AppData\Local\Temp\48e04150e7b404074aa12bd9aaf09cb0aad81cefab68f5f6cf599d46163bd8ad.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3924
    • C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe
      "C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe" 1025d929eadf4406165637b670f8e1 84 1056 en nw eyJ4ZG1fcCI6IjQiLCJ4ZG1fYyI6ImRlZmF1bHQ4ODg4IiwibGFuZyI6ImVuIiwieGRtX2UiOiJodHRwczpcL1wvd3d3LmFyY2dhbWVzLmNvbVwvZW5cL2dhbWVzXC9uZXZlcndpbnRlciIsImdhbWUiOiJudyIsImZ1bm5lbF9pZCI6IjIwMjEwODA5MDItYTcxODlhMTIyZDk4ZjgyYjM1ZTE5MzYyMWQ4Y2E3NjMyMWI1MTcyZjg3MDJkOWEwMDBkZTc4OWNlYWE4ZWUyMCJ9
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:816
      • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ArcInstall_NW_20210730.exe
        C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ArcInstall_NW_20210730.exe 1025d929eadf4406165637b670f8e1 84 1056 en nw eyJ4ZG1fcCI6IjQiLCJ4ZG1fYyI6ImRlZmF1bHQ4ODg4IiwibGFuZyI6ImVuIiwieGRtX2UiOiJodHRwczpcL1wvd3d3LmFyY2dhbWVzLmNvbVwvZW5cL2dhbWVzXC9uZXZlcndpbnRlciIsImdhbWUiOiJudyIsImZ1bm5lbF9pZCI6IjIwMjEwODA5MDItYTcxODlhMTIyZDk4ZjgyYjM1ZTE5MzYyMWQ4Y2E3NjMyMWI1MTcyZjg3MDJkOWEwMDBkZTc4OWNlYWE4ZWUyMCJ9 -package:"C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\ArcInstall_NW_20210730.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3788
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{80D4CEAC-38B0-4C25-B134-1AA7768B3EE9}
          4⤵
          • Executes dropped EXE
          PID:3016
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8558EBEA-8BFE-4A8E-8C4F-1E06AEC6C345}
          4⤵
          • Executes dropped EXE
          PID:5908
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4EADDF7E-209F-4F45-954E-4C36D4FBBE92}
          4⤵
          • Executes dropped EXE
          PID:6148
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{35228B20-1C78-471E-A79C-E934FF41BA81}
          4⤵
          • Executes dropped EXE
          PID:4024
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0D68AD2-15C9-4F3A-86FA-EBA7F8840285}
          4⤵
          • Executes dropped EXE
          PID:2308
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3ABF5CC-D9F0-4493-B3E3-25BDA9278D98}
          4⤵
          • Executes dropped EXE
          PID:3424
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe PostInstallEvent start "C:\Program Files (x86)\Arc\Register.ini" gamecustom nw 1025d929eadf4406165637b670f8e1 84 1056 en nw eyJ4ZG1fcCI6IjQiLCJ4ZG1fYyI6ImRlZmF1bHQ4ODg4IiwibGFuZyI6ImVuIiwieGRtX2UiOiJodHRwczpcL1wvd3d3LmFyY2dhbWVzLmNvbVwvZW5cL2dhbWVzXC9uZXZlcndpbnRlciIsImdhbWUiOiJudyIsImZ1bm5lbF9pZCI6IjIwMjEwODA5MDItYTcxODlhMTIyZDk4ZjgyYjM1ZTE5MzYyMWQ4Y2E3NjMyMWI1MTcyZjg3MDJkOWEwMDBkZTc4OWNlYWE4ZWUyMCJ9
          4⤵
          • Executes dropped EXE
          PID:4488
        • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe
          C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe PostInstallEvent welcome "C:\Program Files (x86)\Arc\Register.ini" gamecustom nw 1025d929eadf4406165637b670f8e1 84 1056 en nw eyJ4ZG1fcCI6IjQiLCJ4ZG1fYyI6ImRlZmF1bHQ4ODg4IiwibGFuZyI6ImVuIiwieGRtX2UiOiJodHRwczpcL1wvd3d3LmFyY2dhbWVzLmNvbVwvZW5cL2dhbWVzXC9uZXZlcndpbnRlciIsImdhbWUiOiJudyIsImZ1bm5lbF9pZCI6IjIwMjEwODA5MDItYTcxODlhMTIyZDk4ZjgyYjM1ZTE5MzYyMWQ4Y2E3NjMyMWI1MTcyZjg3MDJkOWEwMDBkZTc4OWNlYWE4ZWUyMCJ9
          4⤵
          • Executes dropped EXE
          PID:5320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe

    Filesize

    17.6MB

    MD5

    1d7ea7d972ddb4482cfce8620f67efc0

    SHA1

    3f542f6de1ae4d15d57403d6275f0cfc59b34330

    SHA256

    88646aad46701a2e6f899f74b4af578e2211f9f2896b3cea729c3c2593eb8699

    SHA512

    cd4d0862075ac048e7f880d2df1221324f14f1612d07a26d639a04b75f2911134b446acb8b9cb107502523a5440a80ccc4b5f8b8c399c9e980ef4547d5392d71

  • C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe

    Filesize

    17.6MB

    MD5

    1d7ea7d972ddb4482cfce8620f67efc0

    SHA1

    3f542f6de1ae4d15d57403d6275f0cfc59b34330

    SHA256

    88646aad46701a2e6f899f74b4af578e2211f9f2896b3cea729c3c2593eb8699

    SHA512

    cd4d0862075ac048e7f880d2df1221324f14f1612d07a26d639a04b75f2911134b446acb8b9cb107502523a5440a80ccc4b5f8b8c399c9e980ef4547d5392d71

  • C:\Users\Admin\AppData\Local\Temp\ArcInstall_NW_20210730.exe

    Filesize

    17.6MB

    MD5

    1d7ea7d972ddb4482cfce8620f67efc0

    SHA1

    3f542f6de1ae4d15d57403d6275f0cfc59b34330

    SHA256

    88646aad46701a2e6f899f74b4af578e2211f9f2896b3cea729c3c2593eb8699

    SHA512

    cd4d0862075ac048e7f880d2df1221324f14f1612d07a26d639a04b75f2911134b446acb8b9cb107502523a5440a80ccc4b5f8b8c399c9e980ef4547d5392d71

  • C:\Users\Admin\AppData\Local\Temp\ispCA27.tmp

    Filesize

    176KB

    MD5

    d825fb1910554cf12b016d55fe447bbb

    SHA1

    8ad2abfced146979fa9ddcf54d4e738e2d867d87

    SHA256

    f7b35c84326a855b0567a8b5065d5972f2eef3cf5d3c81465a7d4e6f5ca99e8d

    SHA512

    728e5a0c8d5be90877913dfd35b7fa58e4e376d59f4f9f245e59102d781c9df1d1bd1610b09d5030928028fa7c0e64b46af1f2df753deac0312e908dff90d472

  • C:\Users\Admin\AppData\Local\Temp\skinb44c.rra

    Filesize

    25KB

    MD5

    2c274d3cbe204131726fb6c502c95354

    SHA1

    35e3a917511d94cb843b9a2b763e39be7216a23a

    SHA256

    c516154bed4f458ac76b3f7db2ce9b47ed2a0eab738229cdbfd3259e8240e89c

    SHA512

    fd1d5658200550ea680e9d7cc97bb961e086dce0d4dbc30d6fa663cc85f9779dec65600724daf649a1232c9be5beac5a392cc0c1438333f7d43d830aeca8406f

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\ISBEW64.exe

    Filesize

    178KB

    MD5

    3ab32dd91c57cbf06693bcc8d6be7250

    SHA1

    a5d6d242707a1c744c0a67f6922a67443f412015

    SHA256

    aa05cb3d91c14b87f61a7d0c85ff87b8a306a2ec16e69821ee10b65067509e10

    SHA512

    721697a839fced56f1dd40b22fa6a2d3a10cfa36d4d7e8a21eb576b4a80922636b7a6ce41a3f8b51e6ff8f66977e5fd7dd06fb96453a49bc916b68bfb4e042ea

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe

    Filesize

    2.5MB

    MD5

    d8c093a5c78a47e8f48a88a3a1ba7b75

    SHA1

    66a73890e5bdccd36a8fc6076cbc1b1ecc46d9dc

    SHA256

    6b8a7eef3df84e053ec95fec9f2915d44583377ed79e4a21f55cbdba277553b0

    SHA512

    bcfd3bf238e9819f4620273be530c5693e35d9c5efa2fcb3c0c9fcd6145d983b59434af7ae6b95be3900ac54d8d1735da5323cc60aa9efc772a18693328d9aa0

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe

    Filesize

    2.5MB

    MD5

    d8c093a5c78a47e8f48a88a3a1ba7b75

    SHA1

    66a73890e5bdccd36a8fc6076cbc1b1ecc46d9dc

    SHA256

    6b8a7eef3df84e053ec95fec9f2915d44583377ed79e4a21f55cbdba277553b0

    SHA512

    bcfd3bf238e9819f4620273be530c5693e35d9c5efa2fcb3c0c9fcd6145d983b59434af7ae6b95be3900ac54d8d1735da5323cc60aa9efc772a18693328d9aa0

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe

    Filesize

    2.5MB

    MD5

    d8c093a5c78a47e8f48a88a3a1ba7b75

    SHA1

    66a73890e5bdccd36a8fc6076cbc1b1ecc46d9dc

    SHA256

    6b8a7eef3df84e053ec95fec9f2915d44583377ed79e4a21f55cbdba277553b0

    SHA512

    bcfd3bf238e9819f4620273be530c5693e35d9c5efa2fcb3c0c9fcd6145d983b59434af7ae6b95be3900ac54d8d1735da5323cc60aa9efc772a18693328d9aa0

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\ArcDepends.exe

    Filesize

    2.5MB

    MD5

    d8c093a5c78a47e8f48a88a3a1ba7b75

    SHA1

    66a73890e5bdccd36a8fc6076cbc1b1ecc46d9dc

    SHA256

    6b8a7eef3df84e053ec95fec9f2915d44583377ed79e4a21f55cbdba277553b0

    SHA512

    bcfd3bf238e9819f4620273be530c5693e35d9c5efa2fcb3c0c9fcd6145d983b59434af7ae6b95be3900ac54d8d1735da5323cc60aa9efc772a18693328d9aa0

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\DIFxData.ini

    Filesize

    84B

    MD5

    1eb6253dee328c2063ca12cf657be560

    SHA1

    46e01bcbb287873cf59c57b616189505d2bb1607

    SHA256

    6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1

    SHA512

    7c573896abc86d899afbce720690454c06dbfafa97b69bc49b8e0ddec5590ce16f3cc1a30408314db7c4206aa95f5c684a6587ea2da033aecc4f70720fc6189e

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\FontData.ini

    Filesize

    37B

    MD5

    8ce28395a49eb4ada962f828eca2f130

    SHA1

    270730e2969b8b03db2a08ba93dfe60cbfb36c5f

    SHA256

    a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932

    SHA512

    bb712043cddbe62b5bfdd79796299b0c4de0883a39f79cd006d3b04a1a2bed74b477df985f7a89b653e20cb719b94fa255fdaa0819a8c6180c338c01f39b8382

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isres_0x0409.dll

    Filesize

    1.4MB

    MD5

    53bb561261fdfec940064f638eb21fdc

    SHA1

    ae81292293b35fe218f92e30a55d010d2c61966f

    SHA256

    cfc5472e40dd68608468829db1c3d6b8cf2d8cb2c5c61d89187a0eb8c5198fa8

    SHA512

    05b313cfbe3a2a9a29ed63c03df72b32202d69ced1e3dd1419cad1dec42fd9cfd87d279b89fc1ecb5ae2479f2187e723250156096ed33de8a899ba945e2f44ce

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isres_0x0409.dll

    Filesize

    1.4MB

    MD5

    53bb561261fdfec940064f638eb21fdc

    SHA1

    ae81292293b35fe218f92e30a55d010d2c61966f

    SHA256

    cfc5472e40dd68608468829db1c3d6b8cf2d8cb2c5c61d89187a0eb8c5198fa8

    SHA512

    05b313cfbe3a2a9a29ed63c03df72b32202d69ced1e3dd1419cad1dec42fd9cfd87d279b89fc1ecb5ae2479f2187e723250156096ed33de8a899ba945e2f44ce

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isres_0x0409.dll

    Filesize

    1.4MB

    MD5

    53bb561261fdfec940064f638eb21fdc

    SHA1

    ae81292293b35fe218f92e30a55d010d2c61966f

    SHA256

    cfc5472e40dd68608468829db1c3d6b8cf2d8cb2c5c61d89187a0eb8c5198fa8

    SHA512

    05b313cfbe3a2a9a29ed63c03df72b32202d69ced1e3dd1419cad1dec42fd9cfd87d279b89fc1ecb5ae2479f2187e723250156096ed33de8a899ba945e2f44ce

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isuser_0x0409.dll

    Filesize

    200KB

    MD5

    b01e233691cedde66b6c44701187aa94

    SHA1

    a91a7dbcf51ab762346a630bc5d4853b88bf79f9

    SHA256

    1712cd62294acae28d1564dc74f2c7122c22eba8219f095eb97c6edb6d93f5ce

    SHA512

    b9c157c486595a8a2f7566e878ed17aee2b66f1fcdf469f4544d893ca2ba8596c965be5a387fdd812dd3592fb35905f5ff91b0a12e89af95f9abb8f2dc02452a

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isuser_0x0409.dll

    Filesize

    200KB

    MD5

    b01e233691cedde66b6c44701187aa94

    SHA1

    a91a7dbcf51ab762346a630bc5d4853b88bf79f9

    SHA256

    1712cd62294acae28d1564dc74f2c7122c22eba8219f095eb97c6edb6d93f5ce

    SHA512

    b9c157c486595a8a2f7566e878ed17aee2b66f1fcdf469f4544d893ca2ba8596c965be5a387fdd812dd3592fb35905f5ff91b0a12e89af95f9abb8f2dc02452a

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\_isuser_0x0409.dll

    Filesize

    200KB

    MD5

    b01e233691cedde66b6c44701187aa94

    SHA1

    a91a7dbcf51ab762346a630bc5d4853b88bf79f9

    SHA256

    1712cd62294acae28d1564dc74f2c7122c22eba8219f095eb97c6edb6d93f5ce

    SHA512

    b9c157c486595a8a2f7566e878ed17aee2b66f1fcdf469f4544d893ca2ba8596c965be5a387fdd812dd3592fb35905f5ff91b0a12e89af95f9abb8f2dc02452a

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\isrt.dll

    Filesize

    426KB

    MD5

    eb0be8298b7dd0c274d496ce32e9025f

    SHA1

    15c80ab8244a447a71dd3e09dea5dc0aa1f418a1

    SHA256

    068c7f1c13ab71acc4dd87511f0cc094e8f7976ebfbf0bada7ce737832c81c19

    SHA512

    8111932e6b3c54107ae52f9afd1b5ec28448e1d220343a7b1c6b71458dba854b3836b2ea179c6e9d15ffdbc35c17c8358016ebc415b7d3ad351d391f7049ea07

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\isrt.dll

    Filesize

    426KB

    MD5

    eb0be8298b7dd0c274d496ce32e9025f

    SHA1

    15c80ab8244a447a71dd3e09dea5dc0aa1f418a1

    SHA256

    068c7f1c13ab71acc4dd87511f0cc094e8f7976ebfbf0bada7ce737832c81c19

    SHA512

    8111932e6b3c54107ae52f9afd1b5ec28448e1d220343a7b1c6b71458dba854b3836b2ea179c6e9d15ffdbc35c17c8358016ebc415b7d3ad351d391f7049ea07

  • C:\Users\Admin\AppData\Local\Temp\{11C2C45A-9DDB-4968-A826-8E319B081DC3}\{CED8E25B-122A-4E80-B612-7F99B93284B3}\setup.inx

    Filesize

    267KB

    MD5

    e4e37b90a9d5c428ac36797ff7c8a43c

    SHA1

    e39e62ffcaa315a6da7f2656963ca0edec24cb74

    SHA256

    a8d738b2debf9eaa253bf31b8d1f9519b1d90c07fd6e4467bfc066e465db0767

    SHA512

    32dc33e8ee22fb7ffa264604b5733ef43b29c07cbecfe7f53fd9ffc49f42d1424240b8d4e4e990ca56cea829b3d26438bf7a4627faa64a4c10382da5f279528f

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\0x0409.ini

    Filesize

    21KB

    MD5

    a108f0030a2cda00405281014f897241

    SHA1

    d112325fa45664272b08ef5e8ff8c85382ebb991

    SHA256

    8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

    SHA512

    d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ArcInstall_NW_20210730.exe

    Filesize

    979KB

    MD5

    13f92db576bd258721c879ecf143da01

    SHA1

    2cfc378c7194604bbb7d547e48cb684461ef1a44

    SHA256

    f0a28b2da4c3b99755af85aa9b082387189a05bda3d3020bb3138b6b6efef106

    SHA512

    f8c89a43798a0efbfc83d3d730eb927f76ff62f1cd1ce055603bdd4acab18be2631a50b29a01af2b1a15d744e02f1c2efafc8bb06fd56f756b4c631d8527c0ff

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ArcInstall_NW_20210730.exe

    Filesize

    979KB

    MD5

    13f92db576bd258721c879ecf143da01

    SHA1

    2cfc378c7194604bbb7d547e48cb684461ef1a44

    SHA256

    f0a28b2da4c3b99755af85aa9b082387189a05bda3d3020bb3138b6b6efef106

    SHA512

    f8c89a43798a0efbfc83d3d730eb927f76ff62f1cd1ce055603bdd4acab18be2631a50b29a01af2b1a15d744e02f1c2efafc8bb06fd56f756b4c631d8527c0ff

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ArcInstall_NW_20210730.exe

    Filesize

    979KB

    MD5

    13f92db576bd258721c879ecf143da01

    SHA1

    2cfc378c7194604bbb7d547e48cb684461ef1a44

    SHA256

    f0a28b2da4c3b99755af85aa9b082387189a05bda3d3020bb3138b6b6efef106

    SHA512

    f8c89a43798a0efbfc83d3d730eb927f76ff62f1cd1ce055603bdd4acab18be2631a50b29a01af2b1a15d744e02f1c2efafc8bb06fd56f756b4c631d8527c0ff

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0407.ini

    Filesize

    25KB

    MD5

    ac20509373836978506de9562f946fc1

    SHA1

    0991afacd2133750cf6029dd033b36cfe38a97ec

    SHA256

    e12ab3866c7dab7482e1d571d611549d4485a5d7dd808590d7717b028b9db38b

    SHA512

    73643f22fb0db6ca1f495b1b199bb78828463d1b525d7d5881e42a5bbdf858d16828890fe48b597795166387b0300b2c72cd562ca4c978dbaafceb1d19324aec

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0409.ini

    Filesize

    21KB

    MD5

    a108f0030a2cda00405281014f897241

    SHA1

    d112325fa45664272b08ef5e8ff8c85382ebb991

    SHA256

    8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948

    SHA512

    d83894b039316c38915a789920758664257680dcb549a9b740cf5361addbee4d4a96a3ff2999b5d8acfb1d9336da055ec20012d29a9f83ee5459f103fbeec298

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x040a.ini

    Filesize

    24KB

    MD5

    d7159f79958f9611b3819b36aff90ea8

    SHA1

    f72828a19cbf4f377d3b04b1748be02aa1f24e54

    SHA256

    eaa331f29d1f99573aeb905c3db68e7616447b6060301428521d6a7d3e959b9d

    SHA512

    8fb57738a210a18bccd76c284c3aa0e3383abc363dbcf77b5cd4f16bad4871685711635a9d7471ed12238dcd1574ae90dc781fbc33d5de9a77364b196beecd22

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x040c.ini

    Filesize

    25KB

    MD5

    1176e04ef1d1cb4b925fd7565ee4321c

    SHA1

    057f6adac8304c9d25e53edf537195b58415adb3

    SHA256

    ff99db0bfb7c302fc60a4951b72d4a285ce70234e59cdafcc47b6b31a6ff2166

    SHA512

    2da165382f62504980645e2af68e102bf299f80a8f748d07c3fdbfec5088b0dfa833787d5efb18e63c1405ac79f8de61e232890f85be59d4f69fc34d8d9e7149

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0410.ini

    Filesize

    24KB

    MD5

    690787860d23f973b9c9b251aea27bbd

    SHA1

    f2adead82a3e9015949ad905be510c704c92906e

    SHA256

    f6c863a04c167583511a716e9d33a777fb922b82cb3eacb4f55d9e56b09b9a34

    SHA512

    3a9f2a4658751499c6b4744a7e13cdc6c7c47f8e8b83907e8157cebaffa41c4be75e28e65138eb51d946fc6a312f8b41b7b3b5e852c0c528c0638f1f70466db1

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0415.ini

    Filesize

    23KB

    MD5

    67d15753e278de2d6d607be083a4dea5

    SHA1

    bad1cf703f79d84c5987b5eb84f4390cecfd9f82

    SHA256

    7e9c1e9787364be6ccbf026c1a842ab56279ab26c7dca428d875e983e84ee58c

    SHA512

    40acf9049f34c9f1a2b4ba63873a8a5f1cc386ea066dbb3549390be705aac13ca86ec14272354d5c63592255eda1f1144e8636d60dc62b9e7381e95f0505d177

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0416.ini

    Filesize

    23KB

    MD5

    c405c76cb3b7a2e0c838a44ea550fbac

    SHA1

    eb16e65ac7e67da6e093f1a847faf97479ad78c5

    SHA256

    a6828eb5ef5b5151109e9282eb4bcd533977a24b774ec6e906e639e2c639e762

    SHA512

    96cbef932ff801048ac2d39634484792d1257bb5fc900605d80f7d9e0dd0bb14b55c094c3a9ed8f85d1214d734c12b5e1af011ba01b7e53b3902116eb279f166

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x0419.ini

    Filesize

    22KB

    MD5

    21132d49c8c7ab8a96be2fc33410366d

    SHA1

    4c79e2c47a1d462ccd5119a1e320d02f9a718efb

    SHA256

    45ac44420e048ee23e513fd0d3ecb83dd20a94cda9a394a00ba6caff474ecef4

    SHA512

    fb307048a71cf31d575a0e048acd8a8dbd69eae15a6fe87ab90feee053f523d407fba5fdc307f5ebb322682cae503db79da1ced49b313eb1d0bc93a8c1bd53ff

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\0x041f.ini

    Filesize

    22KB

    MD5

    966466e060ef70ace6ecd13ffaa75a75

    SHA1

    18b871013e44dba84c0cccbcab4109813f7319a7

    SHA256

    a21b100589e6fd859037bb7161e008e72e15e2f8c061cf9c42dbed14f3246847

    SHA512

    822f4017e9fe53cb44a275ee2f18b17e7ac08d4208efda662dd3664dcea1dc75a0fa9a0143841efb435076d0e61109f5b3a2161e1ac0024303bfb3439d4f2a1b

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\ISSetup.dll

    Filesize

    1.6MB

    MD5

    5105f245f8a9c16e76549629098fb6bd

    SHA1

    23c7842047bda3459147b8445bd2e113070a183b

    SHA256

    adc4a580c373ae729b2bde63f88dcac1a9ca5befd7c648db2801b010b9c757cb

    SHA512

    60b9615a3a94322d4e3d733f7787024fa57af5c8248405a65b89fa94abbc02e35bc2145a2399bdaa29dcb8c7c6948d5ec866c2c88ae5c0901274debe274be2e0

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\data1.cab

    Filesize

    6.5MB

    MD5

    d174e9e74d3974a611635907bc63b46a

    SHA1

    86d3b83a2cddda1614cd098a53fa1087bdd88810

    SHA256

    e948b752e6a163cbfe1ff96cd1218a86395dbb3288bdce48bb009aea3c61005b

    SHA512

    5668280374c9bb9e1d6caa3164c85721ed008dc51ce0cc37bccad4a6bb486d458e3ef0bb5aa08a3e1613c3d44163b9ee918ef98fcecca80a0f4d72be6934115f

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\data1.hdr

    Filesize

    32KB

    MD5

    572aaabfda6e3bd1b1a687b288c52f4d

    SHA1

    9831dfa789eb6bcb829fef9dbb6e6f1f89bd62d4

    SHA256

    e157ca8a8843e2f7b27b3bc5a40eed23fa831c8a380a44fe11a6158654466ea3

    SHA512

    bedac23350ff6ed98ca02f1e4fe19b18139d2436cc3f72fcf0d95b8f48ca1e5531f2b0651498d83626291f22d8aabbd44eb31cce1c673367596bd8adab3693bb

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\layout.bin

    Filesize

    818B

    MD5

    fb9710de3329f1ec2163fbd6ce4a3795

    SHA1

    0317eea27f00f1f636bfa42d5d1895849666158b

    SHA256

    7505750c331fe285b8b70f63caf006da1dcc094d462105c5c466e69532a8bdcf

    SHA512

    83571c19aecb3fd16011742e22875620d019bde47a069e23fff0d12cf8017c5e0dd8e6ceb853a460af5368b6f12b0fecb873c4f00be2b6eba539bb550b17fb59

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\setup.ini

    Filesize

    2KB

    MD5

    208554e9530ab131c1d01fc7ed143549

    SHA1

    8713507494d3db579696c582de9c2a18afa19b06

    SHA256

    b1fbc25cfa7d445094ca5a22840da04bbe7023792fe13dff24596132e016885f

    SHA512

    a63fec975f7299cba48ca6114007e4ff1bbfd700c8f739d660c370854281cdd802b5940dd4677530d0f4b37dc56eb1c96dd1ce9c8fdf2e299147a115660f6512

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\setup.inx

    Filesize

    267KB

    MD5

    e4e37b90a9d5c428ac36797ff7c8a43c

    SHA1

    e39e62ffcaa315a6da7f2656963ca0edec24cb74

    SHA256

    a8d738b2debf9eaa253bf31b8d1f9519b1d90c07fd6e4467bfc066e465db0767

    SHA512

    32dc33e8ee22fb7ffa264604b5733ef43b29c07cbecfe7f53fd9ffc49f42d1424240b8d4e4e990ca56cea829b3d26438bf7a4627faa64a4c10382da5f279528f

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\Disk1\setup.isn

    Filesize

    176KB

    MD5

    d825fb1910554cf12b016d55fe447bbb

    SHA1

    8ad2abfced146979fa9ddcf54d4e738e2d867d87

    SHA256

    f7b35c84326a855b0567a8b5065d5972f2eef3cf5d3c81465a7d4e6f5ca99e8d

    SHA512

    728e5a0c8d5be90877913dfd35b7fa58e4e376d59f4f9f245e59102d781c9df1d1bd1610b09d5030928028fa7c0e64b46af1f2df753deac0312e908dff90d472

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ISSetup.dll

    Filesize

    1.6MB

    MD5

    5105f245f8a9c16e76549629098fb6bd

    SHA1

    23c7842047bda3459147b8445bd2e113070a183b

    SHA256

    adc4a580c373ae729b2bde63f88dcac1a9ca5befd7c648db2801b010b9c757cb

    SHA512

    60b9615a3a94322d4e3d733f7787024fa57af5c8248405a65b89fa94abbc02e35bc2145a2399bdaa29dcb8c7c6948d5ec866c2c88ae5c0901274debe274be2e0

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\ISSetup.dll

    Filesize

    1.6MB

    MD5

    5105f245f8a9c16e76549629098fb6bd

    SHA1

    23c7842047bda3459147b8445bd2e113070a183b

    SHA256

    adc4a580c373ae729b2bde63f88dcac1a9ca5befd7c648db2801b010b9c757cb

    SHA512

    60b9615a3a94322d4e3d733f7787024fa57af5c8248405a65b89fa94abbc02e35bc2145a2399bdaa29dcb8c7c6948d5ec866c2c88ae5c0901274debe274be2e0

  • C:\Users\Admin\AppData\Local\Temp\{5B89437C-17C5-4B61-B2BD-7B9B113B4963}\setup.ini

    Filesize

    2KB

    MD5

    208554e9530ab131c1d01fc7ed143549

    SHA1

    8713507494d3db579696c582de9c2a18afa19b06

    SHA256

    b1fbc25cfa7d445094ca5a22840da04bbe7023792fe13dff24596132e016885f

    SHA512

    a63fec975f7299cba48ca6114007e4ff1bbfd700c8f739d660c370854281cdd802b5940dd4677530d0f4b37dc56eb1c96dd1ce9c8fdf2e299147a115660f6512

  • memory/3788-10535-0x0000000010000000-0x0000000010114000-memory.dmp

    Filesize

    1.1MB

  • memory/3788-5402-0x00000000026D0000-0x00000000026D2000-memory.dmp

    Filesize

    8KB

  • memory/3788-10510-0x0000000010000000-0x0000000010114000-memory.dmp

    Filesize

    1.1MB

  • memory/3788-5401-0x0000000010000000-0x0000000010114000-memory.dmp

    Filesize

    1.1MB

  • memory/3924-133-0x0000000000400000-0x0000000000664000-memory.dmp

    Filesize

    2.4MB

  • memory/3924-152-0x0000000000400000-0x0000000000664000-memory.dmp

    Filesize

    2.4MB

  • memory/3924-139-0x0000000000400000-0x0000000000664000-memory.dmp

    Filesize

    2.4MB

  • memory/3924-134-0x0000000000400000-0x0000000000664000-memory.dmp

    Filesize

    2.4MB

  • memory/3924-163-0x0000000000400000-0x0000000000664000-memory.dmp

    Filesize

    2.4MB